*ren* PSN Down, Customer Info Compromised

Nobody got facts on any of this, those that have it wont say a word. But there is plenty of pointers that back it up.

Math that reverse engineered the Jig hack clearly stated that without Geohots original "glitch hack" the Jig wouldn't have come to be. Without the OtherOS option Geohot wouldn´t have had an easy way to snoop around with. So it´s not fact but it does seem plausible.

It's actually just as likely that their exposure of these flaws would have given Sony the opportunity to fix server vulnerabilities to prevent such an intrusion and only their hubris prevented a fix from happening. (And I snicker at the thought that a retail consumer device was their primary server security)

However, the fact remains that for all you know a ps3 wasn't even involved in the intrusion and it serves no purpose to go around pointing fingers without any real information that we are unlikely to ever get.
 
It's actually just as likely that their exposure of these flaws would have given Sony the opportunity to fix server vulnerabilities to prevent such an intrusion and only their hubris prevented a fix from happening. (And I snicker at the thought that a retail consumer device was their primary server security)

It should have made them re-think their so called "security" on every lvl not just focus on getting the PS3 locked down again, couldn´t agree more.

However, the fact remains that for all you know a ps3 wasn't even involved in the intrusion and it serves no purpose to go around pointing fingers without any real information that we are unlikely to ever get.

Very true, i am thinking of Geohots comments when i suggest that a hacked PS3 was in play at some point.
 
Last edited by a moderator:
Yes, and reading a PR FAQ isn't necessary for me to know how the PSN works. I'm fairly confident of my knowledge of the workings of the PSN (marketing name) vs. the information of a generalized PR release.
Do you work for Sony? Unless you do, and in the PSN group, then I submit that you do not know how PSN works. You can make educated guesses based on how you would have done it, or how it's normally done in the industry, but that's all they are: guesses.
 
he helped people steal our personal info.

As I said before there's 2 ways to look at it and both are just as likely.

1) He broke the ps3 which exposed a vulnerability to PSN, which could have made possible the intrusion, but also should have made Sony aware of it months ago. So if true you can blame him for making it possible, but mostly you should blame Sony for not being vigilant with their security. And if the lynchpin of their security for PSN was a retail consumer product there was a serious problem with their security from day 1, because someone is going to break it sooner or later.

2) The criminally motivated hack had nothing to do with the PS3.

either way its pretty hard to try and pass this off as "Geohotz's fault", his arrogance (and joy) on the matter is immaterial.
 
I either already forgot or never heard of the play.com breach - I was a customer there too. So I guess nothing much new leaked then!
 
The sad thing is there isn't any security good enough for hackers, Even RSA got hacked, a very respectable security company that provides security solutions for a wide range of customers ex. governments,banks, big enterprises and so on.

In the end i'm as a consumer are going to pay for this crap in some way, it doesn't matter if it is microsoft,sony or nintendo who got hacked or for that matter in what way even if it's just for running homebrew. in the long run as a gamer i will loose. Some if not all of platform holders will take measurement to secure there platforms in ways that cost money or they will cut features. If they feel that you can't do business in gaming due to hacking/piracy they will leave that market.
 
Last edited by a moderator:
The sad thing is there isn't any security good enough for hackers, Even RSA got hacked, a very respectable security company that provides security solutions for a wide range of customers ex. governments, big enterprises and so on.

In the end i'm as a consumer are going to pay for this crap in some way, it doesn't matter if it is microsoft,sony or nintendo who got hacked or for that matter in what way even if it's just for running homebrew. in the long run as a gamer i will loose. Some if not all of platform holders will take measurement to secure there platforms in ways that cost money or they will cut features. If they feel that you can't do business in gaming due to hacking/piracy they will leave that market.

No one is leaving anything. MS would have left the software business a long time ago if hacking was the reason. So would many other companies in their respective fields.

The criminal element exists throughout society. It's not just limited to gaming companies. Sony had security in place because they expected hackers to tamper with the service. It's not like there was some magical truce breached between Sony and every hacker that allowed Sony to run it's systems without protection. PSN, like any big service is a strong target for hackers. Sony being aware has security measures in place.

What occurred is simple. Sony's security was not adequate to stop the hackers and here we are today. There are many factors here that we don't know and might never learn. Such as:

1. When the PS3 was hacked, were internal audits were done to ensure the core network was safe and could not be breached? Details of these findings and countermeasures would be great to know.

2. Why did Sony wait so long to acknowledge this?

3. How were the usernames and passwords stored that allowed them to be compromised?

4. If Sony states that CVV information is not stored, then how are people able to make repeat purchases with the card on file without needing to input the CVV number each time?

5. What is Sony doing to gain end user trust? Why should anyone trust Sony with ANY private information?
 
4. If Sony states that CVV information is not stored, then how are people able to make repeat purchases with the card on file without needing to input the CVV number each time?

I think because CVV #s aren't actually needed to perform a credit transaction. Its an extra set of numbers that online merchants used to limited their liability to credit fraud. Its an extra verification step but its a step not needed by credit companies to allow a transaction.

CVV info isn't suppose to be stored by any merchant as its prohibited in merchant agreements. Since your CC becomes tied to your PSN account, Sony only needs to use the CVV only with the initial purchase. The first transaction provides proof that they used your CVV as an extra verification step so each additional transaction doesn't require a CVV.
 
Yeah. It's the same when you are using amazon for instance.
 
I think because CVV #s aren't actually needed to perform a credit transaction. Its an extra set of numbers that online merchants used to limited their liability to credit fraud. Its an extra verification step but its a step not needed by credit companies to allow a transaction.

CVV info isn't suppose to be stored by any merchant as its prohibited in merchant agreements. Since your CC becomes tied to your PSN account, Sony only needs to use the CVV only with the initial purchase. The first transaction provides proof that they used your CVV as an extra verification step so each additional transaction doesn't require a CVV.

Sony could use you! :) I'm serious. thanks for the explanation.
 
Do you work for Sony?

I don't know that Archie will reply to this directly, but if you go through older posts, you'll have your answer, such as it were. The rest of your post of course stands, but with the caveat that your "then" scenario in the if/then isn't necessarily applicable. In any case, when it comes to Sony and/or console-related news, I would always suggest taking Archie's posts as a value-add to the dialogue.
 

Pure nonsense. In all likelihood some shady individual is trying to use the publicity around the PSN hack to make a quick buck selling a worthless database file. That, or some anon twerp is pretending to sell PSN credit card numbers for the "lulz". This link bait garbage couldn't get approved on N4G when it first showed up and it wasn't until less savvy mainstream outlets started reporting it that it trickled down to the game blogs.
 
Call me cynical but I would bet that letter is more the result of protectionist lobbying efforts (*cough Microsoft*) as opposed to any meaningful interest from the US government about consumer welfare.

Cheers
 
http://graphics8.nytimes.com/packages/pdf/technology/20110428-sony-letter.pdf

US Gov asking questions. Hopefully the information they gather will be made public.

Alot of those question are answered allready. :)

Such as the timeframe:
- They learned that important security had been been breached, the 20th.
- They had to bring outside experts, and do a forensic analysis on the hardware, to discover the full nature of the scope of this particular breach, wich they learnt the 25th.

Sure they might have discovered it earlier, but there where also DDoS-attacks, and lot's of other things going on, wich might have done the job harder.

Sony also can't deliver out alot of the information they are asking for in that letter.
Forinstance, US government can only ask for American citizens credit-card owners information. Not how many people's cc-info is out in the wild, or who's been stolen.
There is also different privacy-rules for someone who's living in a nation in EU territory, or someone who's not part of the EU.

Sony also can't order banks to start monitoring of other transactions done from my account, other than the transactions involving me and them.
Afterall, my internetporn is private.

But they can provide us with contact information to companies wich does this free of charge. i.e. like the 5 comapnies in US were mentioned in original notification, aswell as US goverment contact-persons, and Sony's own phone number if you have more questions or need help.

- European/African/Australia or Asian need to contact their local Sony support to figure out what services they can use, you can find phone numbers here, that link also contains the answer to allmost all the wuestions asked. :)

They also mentioned they were working alongside both govermental agencies and

As for asking if Sony have figured out who have done this, that's just stupid.
They can't inform the public if they do, before he is caught and sentenced, they have to be able to build a case, and gather evidence, and not give the suspects a chance to flee.
I mean, what do they expect? Yeah, we're pretty sure it were done by a mr. William Henry Gates III, in Medina, Washington.

I'm actually impressed by the measures Sony has taken, especially on the blog.
If we just read 3-4 articles on playstation blog, you're mostly updated on all you need to know.. :) Only problem is that we can't comment until PSN. :p
Much better than if we compare to measures other big companies like Citybank, Discovery, Microsoft and other big companies wich also sufferes data-theft from time to time. :)

The thing I would want Sony to get fixed asap (besides PSN offcourse), is that no more cryptic error-messages on your devices, very few of your customers are 'rainman', so if you have errorcode 8million something, also add a text, i.e. read about error 8million on http://psn.com/error/8million.htm, on the errorbox, or something similar.
Then everyone could get to the information they need, instead of only those who know about google. :)
You can even update the webpage, with more links to more information.
If it's something like it's now, as to why PSN is shut down. :)
 
LOL.

however....

http://www.dailytech.com/article.aspx?newsid=21506

Im heading to my bank in the morning to get a replacement card.
As others say, chances are this is one criminal trading in on another's efforts. How does anyone know the CC info is valid? There's no gaurantee or consumer protection in a purchase case here. Could easily be someone offering bogus CC numbers to make a quick buck (may have the real PSN details).

As ever, there are rumours and counter rumours and PR spin left, right and centre, and we have no real idea what's going on. :(
 
Back
Top